libsdl-org / SDL_image

Image decoding for many popular formats for Simple Directmedia Layer.
zlib License
559 stars 182 forks source link

Failing to save a JPEG with libjpeg crashes when it uses an uninitialized jmp_buf #429

Closed smcv closed 6 months ago

smcv commented 6 months ago

To reproduce:

Expected result: Saving with libjpeg fails. SDL_image catches the error and maybe tries to fall back to tinyjpeg. Either the file is saved successfully with tinyjpeg, or tinyjpeg fails cleanly too; either way, there is no crash.

Actual result: When IMG_SaveJPG_RW_jpeglib() sets jerr.errmgr.error_exit = my_error_exit, the result of a failure is a longjmp into jerr.escape, but IMG_SaveJPG_RW_jpeglib() never actually initializes jerr.escape and the result is a crash.

Suggested solution: IMG_SaveJPG_RW_jpeglib() should setjmp(jerr.escape) before it starts compression, the same as in the libjpeg loading code path.

smcv commented 6 months ago

Better reproducer:

$ podman pull registry.gitlab.steamos.cloud/steamrt/scout/sdk:beta
$ podman run --rm -it registry.gitlab.steamos.cloud/steamrt/scout/sdk:beta
# cd
# git clone -bSDL2 https://github.com/libsdl-org/SDL_image
# cd SDL_image
# autoreconf -fi
# ./configure --enable-tests --disable-stb-image
  (AVIF and JXL libraries are not found, this is OK)
# make
# make check VERBOSE=1